A nurse wants to study outpatient medical records to determine a specific pattern of care. Which part of HIPAA should this nurse consult to guide her actions?

Question

1. Accessing data
2. Creating data
3. Disclosing data
4. Destroying data

Answer 1

Accessing data

Rationale: It is the covered organization's obligation not to disclose information improperly when a researcher seeks data that includes private health information. A covered organization is one that "transmits information in an electronic form, and includes health plans, health care clearing houses, and health care agencies.". All covered entities are required to comply with the privacy rule. Researchers will be expected to work closely with clinical agencies used as research sites to ensure that both sides meet HIPAA obligations. Creating data can be done through the course of conducting research. Disclosing data is sharing information about patients' personal health information. The HIPAA law does not provide information on the destroying of data.